This application claims the priority of Korean Patent Application No. 2002-79733, filed on Dec. 13, 2002, in the Korean Intellectual Property Office, which is incorporated herein in its entirety by reference.
1. Field of the Invention
The present invention relates to an Internet network measurement system, and more particularly, to a traffic measurement system and a traffic analysis method thereof to collect traffic data from various points of Internet links and analyze the traffic data for each application.
2. Description of the Related Art
Since the network structure and the traffic characteristics of the Internet are complicated, various methods of measuring the Internet network have been proposed and applied. The measurement of traffic is directly related to the design and the plan of a network at an initial stage, traffic engineering at an operation stage, and the provision of high-quality Internet service. In addition, the measurement of the traffic should be performed in network-related operations.
The measurement method of network performance can be divided into an active measurement method and a passive measurement method. The active measurement method analyzes the performance of a network by loading test packets to a network and then measuring characteristics, such as delay and loss, of the test packets, after the test packets pass through the network. The passive measurement method captures packets that pass through a network without affecting the flow of the packets and analyzes various traffic characteristics based on the captured data.
Measurement of traffic volume has been performed by measuring the used rate of each link on the basis of management information base (MIB) data in devices. Such a method can be easily used due to improved performance and standardization of equipment; however, the method is designed to figure out only the volume of traffic that occupies the links. Thus, it is impossible to analyze the structure and the characteristics of the traffic with the method. Routers have traffic classification functions using port numbers to solve the problem; however, the traffic characteristics of the Internet having various applications cannot be obtained according to the traffic classification by port number.
At present, in order to analyze traffic in detail, a method of collecting packets from the links or collecting traffic data using a netflow function by Cisco Systems, Inc., and then analyzing the collected packets or the collected traffic data is commonly used. Such a method is mainly used for research purpose or to temporarily analyze traffic. However, the method should maintain the packet data for the post analysis payload data of the packets that might be related to user information cannot be collected. Thus, data related to applications is lost, and the analysis is performed based on IP/TCP/UDP header data only. In this case, since only port numbers are used to classify the applications, it is difficult to identify the applications that use the ports by other than a conventional method, such as P2P or streaming services. In addition, since a formal analysis method is not available, many experts are required and a storage device having a large capacity or a high-speed server is required. As a result, traffic cannot be continuously measured and analyzed for a long period of time.
Furthermore, since the traffic path of the Internet is asymmetric, correlated analysis should be performed considering traffic collected from several points in a case where the network has multiple external connectivity(e.g. multi-homing case). However, a system or a method for such analysis has not been formalized currently.